PT-2007-2674 · Blender · Kmz Importwithmesh.Py Script+1

Published 2007-03-03 · Updated 2017-07-29 · CVE-2007-1253

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Blender versions prior to 2.43 kmz ImportWithMesh.py Script for Blender version 0.1.9h

Description The issue allows user-assisted remote attackers to execute arbitrary Python code by importing a crafted KML or KMZ file. This is related to an eval injection vulnerability in the kmz ImportWithMesh.py Script for Blender.

Recommendations For Blender versions prior to 2.43, update to version 2.43 or later to resolve the issue. For kmz ImportWithMesh.py Script for Blender version 0.1.9h, consider disabling the script until a patched version is available.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-1253

Affected Products

Blender

Kmz Importwithmesh.Py Script

References · 15

• http://secunia.com/secunia_research/2007-40/advisory · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1253 · Security Note
• https://osv.dev/vulnerability/CVE-2007-1253 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-1253 · Vendor Advisory
• http://secunia.com/advisories/24991 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-1253 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200704-19.xml · Vendor Advisory
• http://secunia.com/secunia_research/2007-39/advisory · Vendor Advisory
• http://vupen.com/english/advisories/2007/0798 · Note
• http://secunia.com/advisories/24232 · Note
• http://securityfocus.com/bid/22770 · Note
• http://securitytracker.com/id?1017714 · Note
• http://secunia.com/advisories/24233 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32778 · Note
• http://osvdb.org/33836 · Note